From: Coly Li <colyli@suse.de> To: linux-block@vger.kernel.org, linux-nvme@lists.infradead.org, netdev@vger.kernel.org, open-iscsi@googlegroups.com, linux-scsi@vger.kernel.org, ceph-devel@vger.kernel.org Cc: linux-kernel@vger.kernel.org, Coly Li <colyli@suse.de>, Chaitanya Kulkarni <chaitanya.kulkarni@wdc.com>, Christoph Hellwig <hch@lst.de>, Hannes Reinecke <hare@suse.de>, Jan Kara <jack@suse.com>, Jens Axboe <axboe@kernel.dk>, Mikhail Skorzhinskii <mskorzhinskiy@solarflare.com>, Philipp Reisner <philipp.reisner@linbit.com>, Sagi Grimberg <sagi@grimberg.me>, Vlastimil Babka <vbabka@suse.com>, stable@vger.kernel.org Subject: [PATCH v8 1/7] net: introduce helper sendpage_ok() in include/linux/net.h Date: Fri, 25 Sep 2020 23:01:13 +0800 [thread overview] Message-ID: <20200925150119.112016-2-colyli@suse.de> (raw) In-Reply-To: <20200925150119.112016-1-colyli@suse.de> The original problem was from nvme-over-tcp code, who mistakenly uses kernel_sendpage() to send pages allocated by __get_free_pages() without __GFP_COMP flag. Such pages don't have refcount (page_count is 0) on tail pages, sending them by kernel_sendpage() may trigger a kernel panic from a corrupted kernel heap, because these pages are incorrectly freed in network stack as page_count 0 pages. This patch introduces a helper sendpage_ok(), it returns true if the checking page, - is not slab page: PageSlab(page) is false. - has page refcount: page_count(page) is not zero All drivers who want to send page to remote end by kernel_sendpage() may use this helper to check whether the page is OK. If the helper does not return true, the driver should try other non sendpage method (e.g. sock_no_sendpage()) to handle the page. Signed-off-by: Coly Li <colyli@suse.de> Cc: Chaitanya Kulkarni <chaitanya.kulkarni@wdc.com> Cc: Christoph Hellwig <hch@lst.de> Cc: Hannes Reinecke <hare@suse.de> Cc: Jan Kara <jack@suse.com> Cc: Jens Axboe <axboe@kernel.dk> Cc: Mikhail Skorzhinskii <mskorzhinskiy@solarflare.com> Cc: Philipp Reisner <philipp.reisner@linbit.com> Cc: Sagi Grimberg <sagi@grimberg.me> Cc: Vlastimil Babka <vbabka@suse.com> Cc: stable@vger.kernel.org --- include/linux/net.h | 16 ++++++++++++++++ 1 file changed, 16 insertions(+) diff --git a/include/linux/net.h b/include/linux/net.h index d48ff1180879..05db8690f67e 100644 --- a/include/linux/net.h +++ b/include/linux/net.h @@ -21,6 +21,7 @@ #include <linux/rcupdate.h> #include <linux/once.h> #include <linux/fs.h> +#include <linux/mm.h> #include <linux/sockptr.h> #include <uapi/linux/net.h> @@ -286,6 +287,21 @@ do { \ #define net_get_random_once_wait(buf, nbytes) \ get_random_once_wait((buf), (nbytes)) +/* + * E.g. XFS meta- & log-data is in slab pages, or bcache meta + * data pages, or other high order pages allocated by + * __get_free_pages() without __GFP_COMP, which have a page_count + * of 0 and/or have PageSlab() set. We cannot use send_page for + * those, as that does get_page(); put_page(); and would cause + * either a VM_BUG directly, or __page_cache_release a page that + * would actually still be referenced by someone, leading to some + * obscure delayed Oops somewhere else. + */ +static inline bool sendpage_ok(struct page *page) +{ + return !PageSlab(page) && page_count(page) >= 1; +} + int kernel_sendmsg(struct socket *sock, struct msghdr *msg, struct kvec *vec, size_t num, size_t len); int kernel_sendmsg_locked(struct sock *sk, struct msghdr *msg, -- 2.26.2
WARNING: multiple messages have this Message-ID (diff)
From: Coly Li <colyli@suse.de> To: linux-block@vger.kernel.org, linux-nvme@lists.infradead.org, netdev@vger.kernel.org, open-iscsi@googlegroups.com, linux-scsi@vger.kernel.org, ceph-devel@vger.kernel.org Cc: Jens Axboe <axboe@kernel.dk>, Vlastimil Babka <vbabka@suse.com>, Sagi Grimberg <sagi@grimberg.me>, Chaitanya Kulkarni <chaitanya.kulkarni@wdc.com>, Mikhail Skorzhinskii <mskorzhinskiy@solarflare.com>, linux-kernel@vger.kernel.org, stable@vger.kernel.org, Coly Li <colyli@suse.de>, Hannes Reinecke <hare@suse.de>, Jan Kara <jack@suse.com>, Philipp Reisner <philipp.reisner@linbit.com>, Christoph Hellwig <hch@lst.de> Subject: [PATCH v8 1/7] net: introduce helper sendpage_ok() in include/linux/net.h Date: Fri, 25 Sep 2020 23:01:13 +0800 [thread overview] Message-ID: <20200925150119.112016-2-colyli@suse.de> (raw) In-Reply-To: <20200925150119.112016-1-colyli@suse.de> The original problem was from nvme-over-tcp code, who mistakenly uses kernel_sendpage() to send pages allocated by __get_free_pages() without __GFP_COMP flag. Such pages don't have refcount (page_count is 0) on tail pages, sending them by kernel_sendpage() may trigger a kernel panic from a corrupted kernel heap, because these pages are incorrectly freed in network stack as page_count 0 pages. This patch introduces a helper sendpage_ok(), it returns true if the checking page, - is not slab page: PageSlab(page) is false. - has page refcount: page_count(page) is not zero All drivers who want to send page to remote end by kernel_sendpage() may use this helper to check whether the page is OK. If the helper does not return true, the driver should try other non sendpage method (e.g. sock_no_sendpage()) to handle the page. Signed-off-by: Coly Li <colyli@suse.de> Cc: Chaitanya Kulkarni <chaitanya.kulkarni@wdc.com> Cc: Christoph Hellwig <hch@lst.de> Cc: Hannes Reinecke <hare@suse.de> Cc: Jan Kara <jack@suse.com> Cc: Jens Axboe <axboe@kernel.dk> Cc: Mikhail Skorzhinskii <mskorzhinskiy@solarflare.com> Cc: Philipp Reisner <philipp.reisner@linbit.com> Cc: Sagi Grimberg <sagi@grimberg.me> Cc: Vlastimil Babka <vbabka@suse.com> Cc: stable@vger.kernel.org --- include/linux/net.h | 16 ++++++++++++++++ 1 file changed, 16 insertions(+) diff --git a/include/linux/net.h b/include/linux/net.h index d48ff1180879..05db8690f67e 100644 --- a/include/linux/net.h +++ b/include/linux/net.h @@ -21,6 +21,7 @@ #include <linux/rcupdate.h> #include <linux/once.h> #include <linux/fs.h> +#include <linux/mm.h> #include <linux/sockptr.h> #include <uapi/linux/net.h> @@ -286,6 +287,21 @@ do { \ #define net_get_random_once_wait(buf, nbytes) \ get_random_once_wait((buf), (nbytes)) +/* + * E.g. XFS meta- & log-data is in slab pages, or bcache meta + * data pages, or other high order pages allocated by + * __get_free_pages() without __GFP_COMP, which have a page_count + * of 0 and/or have PageSlab() set. We cannot use send_page for + * those, as that does get_page(); put_page(); and would cause + * either a VM_BUG directly, or __page_cache_release a page that + * would actually still be referenced by someone, leading to some + * obscure delayed Oops somewhere else. + */ +static inline bool sendpage_ok(struct page *page) +{ + return !PageSlab(page) && page_count(page) >= 1; +} + int kernel_sendmsg(struct socket *sock, struct msghdr *msg, struct kvec *vec, size_t num, size_t len); int kernel_sendmsg_locked(struct sock *sk, struct msghdr *msg, -- 2.26.2 _______________________________________________ Linux-nvme mailing list Linux-nvme@lists.infradead.org http://lists.infradead.org/mailman/listinfo/linux-nvme
next prev parent reply other threads:[~2020-09-25 15:03 UTC|newest] Thread overview: 26+ messages / expand[flat|nested] mbox.gz Atom feed top 2020-09-25 15:01 [PATCH v8 0/7] Introduce sendpage_ok() to detect misused sendpage in network related drivers Coly Li 2020-09-25 15:01 ` Coly Li 2020-09-25 15:01 ` Coly Li [this message] 2020-09-25 15:01 ` [PATCH v8 1/7] net: introduce helper sendpage_ok() in include/linux/net.h Coly Li 2020-09-25 15:18 ` Greg KH 2020-09-25 15:18 ` Greg KH 2020-09-26 13:28 ` Coly Li 2020-09-26 13:28 ` Coly Li 2020-09-27 12:21 ` Greg KH 2020-09-27 12:21 ` Greg KH 2020-09-25 15:01 ` [PATCH v8 2/7] net: add WARN_ONCE in kernel_sendpage() for improper zero-copy send Coly Li 2020-09-25 15:01 ` Coly Li 2020-09-25 15:01 ` [PATCH v8 3/7] nvme-tcp: check page by sendpage_ok() before calling kernel_sendpage() Coly Li 2020-09-25 15:01 ` Coly Li 2020-09-25 15:01 ` [PATCH v8 4/7] tcp: use sendpage_ok() to detect misused .sendpage Coly Li 2020-09-25 15:01 ` Coly Li 2020-09-25 15:01 ` [PATCH v8 5/7] drbd: code cleanup by using sendpage_ok() to check page for kernel_sendpage() Coly Li 2020-09-25 15:01 ` Coly Li 2020-09-25 15:01 ` [PATCH v8 6/7] scsi: libiscsi: use sendpage_ok() in iscsi_tcp_segment_map() Coly Li 2020-09-25 15:01 ` Coly Li 2020-09-25 20:54 ` Martin K. Petersen 2020-09-25 20:54 ` Martin K. Petersen 2020-09-25 15:01 ` [PATCH v8 7/7] libceph: use sendpage_ok() in ceph_tcp_sendpage() Coly Li 2020-09-25 15:01 ` Coly Li 2020-09-25 15:13 ` Jeff Layton 2020-09-25 15:13 ` Jeff Layton
Reply instructions: You may reply publicly to this message via plain-text email using any one of the following methods: * Save the following mbox file, import it into your mail client, and reply-to-all from there: mbox Avoid top-posting and favor interleaved quoting: https://en.wikipedia.org/wiki/Posting_style#Interleaved_style * Reply using the --to, --cc, and --in-reply-to switches of git-send-email(1): git send-email \ --in-reply-to=20200925150119.112016-2-colyli@suse.de \ --to=colyli@suse.de \ --cc=axboe@kernel.dk \ --cc=ceph-devel@vger.kernel.org \ --cc=chaitanya.kulkarni@wdc.com \ --cc=hare@suse.de \ --cc=hch@lst.de \ --cc=jack@suse.com \ --cc=linux-block@vger.kernel.org \ --cc=linux-kernel@vger.kernel.org \ --cc=linux-nvme@lists.infradead.org \ --cc=linux-scsi@vger.kernel.org \ --cc=mskorzhinskiy@solarflare.com \ --cc=netdev@vger.kernel.org \ --cc=open-iscsi@googlegroups.com \ --cc=philipp.reisner@linbit.com \ --cc=sagi@grimberg.me \ --cc=stable@vger.kernel.org \ --cc=vbabka@suse.com \ /path/to/YOUR_REPLY https://kernel.org/pub/software/scm/git/docs/git-send-email.html * If your mail client supports setting the In-Reply-To header via mailto: links, try the mailto: linkBe sure your reply has a Subject: header at the top and a blank line before the message body.
This is an external index of several public inboxes, see mirroring instructions on how to clone and mirror all data and code used by this external index.